Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

My roommates and I are connected to the internet through a switch. Their computers both have IP addresses that start with 81, according to whatismyip.com. The site says that my IP address starts with 212. My roommate is scaring me, saying that this means my internet usage is being "re-routed" and monitored by someone malicious.

I don't know anything about how networking works and I can't find anything about this online. So could someone please tell me if it's a dangerous sign that my computer has an IP address in a completely different range from the other two computers behind the switch?

Possibly relevant is that the website's lookup service does display the "host name" as my broadband company. Sorry if I'm not providing the necessary information but I have no clue how all this works.

share|improve this question
1  
What is your IP, what is the IP of the roommates? Why is yours suspicious and not theirs? Do you check the right interface? How do you check your IP? ~they theirs? Did you do a whois 212.x.y.z and whois 81.a.b.c? Why not? ;) –  user unknown Jul 11 '11 at 0:41
    
@user unknown 1) I don't want to give out the full address. 2) Because mine is completely different from theirs. 3) I don't understand what "right interface" means. 4) We all used whatismyip.com. 5) Isn't the IP lookup I did the same as a whois? –  blue sand Jul 11 '11 at 0:57
    
1) Why? Do you believe they're magic? 2) But theirs is different from yours too! 3) eth0, eth1, ppp0, wlan0 or localhost, ts. 4) Thanks. 5) I don't know what you used - it shows up your ISP for both adresses? Then: What's the problem? 6) (overall): Why should a hacker change your IP? What's his benefit? –  user unknown Jul 11 '11 at 1:20
    
@user unknown The reason he is worried is that if they are all using the same Internet connection, you would expect the external IP to be the same. Also, a whois is for domain names, he would want to do an "nslookup 212.x.x.x." –  KCotreau Jul 11 '11 at 1:34
1  
@blue sand - Download & burn a Linux live-cd (Ubuntu should work), and do your test again with everybody's computer. If anybody's IP changes, start looking there, since you know that the live-cd is a fixed configursation, apart from any automatic configuration at boot time. –  Joe Internet Jul 11 '11 at 5:25

3 Answers 3

up vote 2 down vote accepted

Some trojans set your browsers to use proxies. Then all traffic is forwarded through some random server in another country. You should be able to tell for sure in a few easy steps:

  1. Check to see if whatever browser you are using has a proxy setting. firefox, IE and Chrome
  2. Do a virus scan with one of the modern virus scan packages that has been fully updated
  3. Look up both IPs in ARIN(US) or RIPE(Europe) to see who owns them. If they are not assigned to your ISP, then something is fishy.
share|improve this answer

No, it could mean that you're ISP is using a transparent proxy like mine does - most ip detection sites and methods break down when that happens - in most cases for me, the two ip addresses detected by checkip (use this and this )are different - the first one is regular ip address detection, and the second works behind, well almost anything (via dyndns)

You may also have problems with sites that need to know your ip address to work.

Good news is, its probably not hacking. Bad news is, its quite often an utter pain since it breaks quite a few things.

share|improve this answer

No, it could mean that your ISP has multiple network blocks on the same interface. The network blocks are often in different regions. You can check up your IP location from GeoIP.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.